CVE-2022-49842

CVE-2022-49842: In the Linux kernel’s ASoC core, a use-after-free in snd_soc_exit() was fixed. The root cause was a missing error check in snd_soc_init() where snd_soc_util_init() could fail and return value was ignored, causing soc_dummy_dev to be unregistered twice. The fix requires handling er...

CVE-2022-49920

Affected product: Linux kernel (netfilter nf_tables). Vulnerability arises from a race in the netlink notifier during object release after the RCU grace period, where the netlink notifier handler might win a race to remove objects still referenced by the transaction context. Root cause: commit re...

CVE-2023-52732

The CVE-2023-52732 issue affects the Linux kernel’s handling of Ceph clients (ceph) where a corrupted snap trace on kclient triggers a protection path. The documented mitigation patches block all further IO/MDS requests and evict the kclient to prevent potential data corruption on the MDS side. C...

CVE-2023-53098

CVE-2023-53098 summary (Linux kernel) : The vulnerability resides in the Media driver gpio-ir-recv under media: rc, where an added remove function plus runtime-pm cleanup is required. If runtime PM is enabled, systems must perform runtime PM cleanup to remove a cpu-latency QoS request; otherwise,...

CVE-2024-26909

CVE-2024-26909 concerns the Linux kernel. A DRM bridge use-after-free in the qcom pmic_glink_altmode path could occur if the dp-hpd bridge is registered before resources are fully acquired, leading to a freed bridge being referenced during display init (possibly causing NULL dereference or attach...

CVE-2024-42065

CVE-2024-42065 relates to the Linux kernel DRM/XE path. A NULL pointer dereference vulnerability in xe_ttm_stolen_mgr_init was fixed by adding an explicit NULL check to ensure the mgr is not NULL before use. The patch updates the function to validate the mgr reference and prevents dereferencing a...

CVE-2024-46846

The CVE-2024-46846 issue is a Linux kernel vulnerability found in the Rockchip SPI driver (spi: rockchip) involving unbalanced runtime PM/system PM handling. The root cause was a commit that stopped respecting runtime PM and unconditionally disabled clocks during system sleep, potentially double-...

CVE-2024-58018

The CVE-2024-58018 issue affects the Linux kernel’s GSP command queue path within the Nouveau nvkm/GSP code. The root cause is in r535_gsp_cmdq_push/r535_gsp_msgq_wait logic: when handling large RPCs, the code treats the available pages as (write pointer, buf_size) and exits the wait prematurely,...

CVE-2025-37909

CVE-2025-37909 affects the Linux kernel net: lan743x subsystem. When GSO is enabled and fragments count is zero, skb is mapped to an EXT descriptor, preventing it from being freed and causing a memory leak. The fix maps the skb to the LS descriptor unconditionally, eliminating the memleak. This i...

CVE-2025-37931

CVE-2025-37931 (btrfs) affects the Linux kernel’s btrfs metadata write path. The issue arises when writing subpage extent buffers (EBs) with a 64k page size, 16k nodsz, and a 4k sectorsize, where the bitmap addressing is based on sectors, yielding 4 bits per node. If a dirty range is found, the c...

CVE-2025-37952

CVE-2025-37952 describes a use-after-free in ksmbd within the Linux kernel. A thread destroying a file via __ksmbd_close_fd can race with another thread holding a reference to the same file, because the existing fp->refcount checks do not prevent the issue. The fix adds ft->lock around the ...

CVE-2023-3866

CVE-2023-3866 : In the Linux kernel ksmbd, the compound-request handling failed to validate session and tree identifiers if the first operation is not an SMB2 ECHO. This could allow a NULL dereference when a subsequent operation accesses work->sess or work->tcon, leading to a local impact. ...

CVE-2023-52825

CVE-2023-52825 — Linux kernel (drm/amdkfd) race condition fix . A race in vram buffer unref (prange->svm_bo) could occur in both the MMU callback and a callback after migrating to system RAM, across async tasks. The issue allowed a potential use-after-free in the AMDGPU SVM path. The vulnerabi...

CVE-2023-52989

CVE-2023-52989 relates to the Linux kernel FireWire subsystem. The issue was a use-after-free in the IEC 61883-1 FCP payload path when multiple user-space listeners read the payload, potentially releasing data too early. The fix duplicates the payload object in kernel space for each listener; the...

CVE-2023-53048

CVE-2023-53048 (Linux kernel) : A fix addresses a warning that could be triggered when both source and sink devices send a Discover Identity message in PD3, which could cause a warning in tcpm_queue_vdm and related code paths. The issue is resolved by the kernel patch set that corrects handling o...

CVE-2024-26756

The CVE-2024-26756 issue affects the Linux kernel’s md (multidisk) subsystem, specifically the raid reshape path. The root cause was registering the sync_thread directly from pers->run() during an interrupted reshape, which could set MD_RECOVERY_RUNNING without guaranteeing that md_do_sync() w...

CVE-2024-26770

CVE-2024-26770 concerns the Linux kernel HID for the Nvidia Shield: a missing null-pointer check in LED initialization (led init path) could dereference NULL after devm_kasprintf() returns NULL. The issue arises during LED initialization within the Nvidia Shield HID handling; the CVSSv3.1 vector ...

CVE-2024-26869

CVE-2024-26869 affects the Linux kernel F2FS filesystem. The issue is a race during GC when truncating meta inode pages, where invalidate_mapping_pages() may fail to drop a page due to unclear status (locked, dirty, writeback), risking data corruption. The documented fix is to use truncate_inode_...

CVE-2024-36912

CVE-2024-36912 (Linux kernel) affects the hv: vmbus component. The fix adds a decryption-status field to struct vmbus_gpadl to track the decrypted state of buffers, enabling callers of vmbus_establish_gpadl() and vmbus_teardown_gpadl() to decide whether to free or leak pages instead of returning ...

CVE-2024-36916

The CVE-2024-36916 issue is in Linux kernel’s blk-iocost code where iocg->delay can be shifted right by too large a value, triggering UBSAN shift-out-of-bounds: shift exponent 64 is too large for 64-bit u64. Exploitation details are not provided in the documents. The remediation described in t...

CVE-2024-38610

The CVE-2024-38610 entry concerns a Linux kernel issue in the acrn_vm_ram_map() path of the ACRN driver. The root cause is flawed follow_pte() usage that can access PFNs incorrectly: (1) it did not verify PTE write permissions (now checked against ACRN_MEM_ACCESS_WRITE); (2) it did not reject ref...

CVE-2024-40921

CVE-2024-40921 impacts the Linux kernel’s networking stack, specifically the bridge/mst path: the change fixes passing a vlan group pointer to br_mst_vlan_set_state by using the already obtained group rather than dereferencing it again. Root cause is a non-functional dereference path related to a...

CVE-2024-42127

CVE-2024-42127 affects the Linux kernel driver for Lima (drm/lima) which uses a shared IRQ. The root cause is that during driver removal, clocks are disabled early while interrupts remain registered due to devm-based management, allowing interrupt handlers to run and access device registers with ...

CVE-2024-42138

CVE-2024-42138 affects the Linux kernel mlxsw mlxsw_linecard_types_init() and mlxsw_linecards_init() in mlxsw core_linecards. When an invalid INI file triggers deallocation, mlxsw_linecard_types_init() frees memory but does not set the pointer to NULL; if an error occurs after the init() call, ml...

CVE-2024-42279

CVE-2024-42279 (Linux kernel) affects the spi/microchip-core interface. The issue occurs when transmitting with rx_len == 0: the RX FIFO is not emptied in the interrupt handler, causing a subsequent transfer to read stale data from the previous RX FIFO into the start RX buffer. The fix is to use ...

CVE-2024-44991

CVE-2024-44991 affects the Linux kernel TCP stack: concurrent calls to tcp_sk_exit_batch() can race with inet_twsk_purge() across dying netns, risking timewait sockets of the exiting netns. The root cause: after the net/core/net_namespace change (commit that batches inet_twsk_purge), tcp_twsk_pur...

CVE-2024-46710

CVE-2024-46710 (Linux kernel): The vulnerability in drm/vmwgfx arises from racing between multiple read buffers in the kms cursor handling, where a buffer unmapped for compare could be re-using contents after an update. The issue is mitigated by introducing a per-path active map count and unmappi...

CVE-2024-46766

CVE-2024-46766 affects the Linux kernel, specifically the ice driver’s VSI handling. The issue comes from moving netif_queue_set_napi to rtnl-protected sections, since netif_queue_set_napi() could be invoked from ice_vsi_rebuild() without rtnl locking during reset. The recommended fix fills napi-...

CVE-2024-57875

Summary of CVE-2024-57875 (Linux kernel): A block-layer memory-reference issue was resolved by ensuring proper RC(U) protection when a disk’s conventional-zones bitmap is updated. The fix adds RCU-aware handling around disk->conv_zones_bitmap access: disk_zone_is_conv() now operates under the ...

CVE-2024-57997

CVE-2024-57997 (Linux kernel) : The vulnerability lies in the wifi/wcn36xx driver memory allocation for wcn->chan_survey, caused by an incorrect size calculation that could leave uninitialized memory. The fix switches to memory allocation via kcalloc to ensure proper initialization when there ...

CVE-2024-58092

In CVE-2024-58092, the Linux kernel NFS server (nfsd) fix removes a duplicate init path: check_for_legacy_methods() no longer calls nfsd4_legacy_tracking_ops->init(), delegating init to nfsd4_client_tracking_init() to avoid triggering BUG_ON() in nfsd4_init_recdir(). The description confirms t...

CVE-2025-21913

CVE-2025-21913 affects the Linux kernel, addressing a vulnerability in x86/amd_nb related to MSR handling for MMCFG. The root cause involved unsafe or unchecked RDMSR accesses (amd_get_mmconfig_range) and Xen guests lacking MSR_FAM10H_MMIO_CONF_BASE support, which could trigger warnings and poten...

CVE-2025-21923

Summary of CVE-2025-21923 (Linux kernel): The vulnerability affects the HID subsystem, specifically the hid-steam driver. When detaching a hid-steam device, the cleanup of the client_hdev used to intercept hidraw access could be scheduled for deferred work reattachment. The previous cleanup order...

CVE-2025-22032

CVE-2025-22032 affects the Linux kernel wifi driver (mt76/mt7921). The vulnerability stems from mt792x_rx_get_wcid dereferencing an uninitialized deflink because it isn’t correctly linked to the sta context, causing a kernel NULL pointer dereference and a subsequent panic. A patch fixes the linka...

CVE-2025-22059

Technical details beyond what is provided in the initial document are not publicly available in the connected documents. Monitor for updates from vendors and security advisories.

CVE-2025-37809

CVE-2025-37809 : In the Linux kernel, the usb: typec: class path fixes a NULL pointer dereference that can occur when concurrent calls to typec_partner_unlink_device race with pointer usage. The patch adds a mutex to protect USB device pointers and the partner device registration, preventing NULL...

CVE-2025-37953

CVE-2025-37953 affects the Linux kernel sch_htb component. The issue stems from a regression caused when htb_qlen_notify() and htb_deactivate() interactions could leave prt pointers NULL, enabling a NULL pointer dereference path via htb_next_rb_node() and in certain qlen/dequeue_backlog sequences...

CVE-2025-37996

Summary: CVE-2025-37996 affects the Linux kernel on ARM64 with KVM. The root cause was an uninitialized local memcache pointer in user_mem_abort() caused by a conditional initialization after the commit that plumbed the pKVM MMU. A code path through kvm_pgtable_stage2_map() could use the uninitia...

CVE-2025-38022

The CVE-2025-38022 issue resides in the Linux kernel RDMA/core where KASAN reports a slab-use-after-free Read in ib_register_device. Root cause: ib_device_rename() renames the device name under a lock while kobject_uevent() accesses the name without lock protection, leading to a race. The fix is ...

CVE-2025-38211

In the Linux kernel, CVE-2025-38211 affects the RDMA/iwcm path where use-after-free of cm_id_private work objects can occur during cm_id destruction. The root cause involved cm_id resource management and last-reference handling; prior fixes flushed pending works at cm_id destruction, but a remain...

CVE-2006-2935

CVE-2006-2935 affects the Linux kernel starting with 2.2.16 and later, where the dvd_read_bca function in the DVD handling code (drivers/cdrom/cdrom.c) assigns the wrong value to a length variable, enabling a local user to trigger a buffer overflow via a crafted USB Storage device and execute arb...

CVE-2006-5757

CVE-2006-5757 is a local privilege vulnerability in the Linux kernel (2.6.x) related to the __find_get_block_slow function within the ISO9660 filesystem. The issue allows a local user to trigger a denial of service (infinite loop) by mounting a crafted ISO9660 image containing malformed data stru...

CVE-2007-4567

CVE-2007-4567 affects the Linux kernel (ipv6_hop_jumbo in net/ipv6/exthdrs.c). The vulnerability arises from improper validation of the hop-by-hop IPv6 extended header, enabling remote attackers to trigger a denial of service via a crafted IPv6 packet that can cause a NULL pointer dereference and...

CVE-2009-1337

CVE-2009-1337 : Affected: Linux kernel up to 2.6.30-rc1 (exit_notify in kernel/exit.c). Root cause: exit_notify does not restrict exit signals when CAP_KILL is held, enabling a local user to set a process exit_signal and use exec to launch a setuid program. Impact: local privilege escalation via ...

CVE-2010-4342

Vulnerability (CVE-2010-4342) in the Linux kernel affects the AUN path when Econet is enabled. The flaw is in the aun_incoming function (net/econet/af_econet.c) and allows remote attackers to trigger a NULL pointer dereference and kernel OOPS, causing a denial of service via UDP-based Acorn Unive...

CVE-2010-5331

CVE-2010-5331 affects the Linux kernel prior to 2.6.34, due to a range-check off-by-one issue in drivers/gpu/drm/radeon/atombios.c that can cause a buffer overflow. The vulnerability is rooted in how a value is used in that path; at least one Linux maintainer believes the CVE may be incorrectly a...

CVE-2011-1767

CVE-2011-1767 affects the Linux kernel prior to 2.6.34, where ip_gre, if built as a module, can trigger a remote denial of service (OOPS) by processing a crafted packet during module loading in net/ipv4/ip_gre.c. Investigations in connected advisories confirm related patches exist to address GRE/...

CVE-2011-2495

CVE-2011-2495 affects the Linux kernel prior to 2.6.39.4. The issue is in fs/proc/base.c where access to /proc/#####/io is insufficiently restricted, allowing local users to poll a file and infer sensitive I/O statistics (e.g., length of another user’s password). The MiracleLinux advisories refer...

CVE-2011-3359

CVE-2011-3359 affects the Linux kernel (pre-2.6.39), specifically the b43 wireless driver. The dma_rx path does not allocate receive buffers properly, enabling remote attackers to crash the system via a crafted frame (DoS). Affected code is in drivers/net/wireless/b43/dma.c. Remediation: upgrade ...

CVE-2012-6548

CVE-2012-6548 affects the Linux kernel: the udf_encode_fh function in fs/udf/namei.c does not initialize a structure member in kernels before 3.6, enabling a local user to read sensitive information from kernel heap memory via a crafted application. Several connected advisories (e.g., Red Hat RHS...